Report generation device, report generation method, and report generation program

Abstract

Create highly readable security reports quickly. [Solution] The report creation device 10 comprises an information input unit 111, an information relationship estimation unit 121, and a report draft creation unit 131. The information input unit 111 receives input of security-related information obtained from multiple information sources. The information relationship estimation unit 121 uses a natural language processing model to estimate the subject of the information and the points of the information mentioned by the additional information that is determined to be related to the main information, based on the main information and additional information included in the input information. The report draft creation unit 131 uses a natural language processing model to create and output a draft of a security report based on the main information and the subject of the information and points of the information mentioned by the additional information related to the main information.

Description

Technical Field

[0001] The present invention relates to a report creation device, a report creation method, and a report creation program.

Background Art

[0002] Conventionally, when creating a security report by a CSIRT (Computer Security Incident Response Team) or the like, it is necessary to refer to a plurality of information sources (for example, blogs of vulnerability discoverers, websites of product vendors including vulnerability correction information, blogs of security vendors, etc.) and grasp what information each contains and whether each information is primary information or not. However, it takes a very long time to grasp this information. In addition, security information contains many technical terms and words specific to events, so it is desirable that the terms be sufficiently explained, but it is difficult to provide necessary and sufficient explanations.

[0003] Also, as a method of summarizing information on related events from a plurality of information sources, there is a combination of clustering and LLM (Large Language Models). However, for example, it is impossible to estimate relationships such as what relationships each piece of information has, and the information to be referred to is limited to related ones.

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

Non-Patent Document 2

[0005] As mentioned above, a security report should ideally indicate whether the collected information is primary source or not, provide sufficient explanations of terminology, and show the relationships between the collected information (i.e., be highly readable). However, with conventional technology, it has been difficult to create such a highly readable security report in a short amount of time.

[0006] Therefore, the present invention aims to solve the aforementioned problems and to create highly readable security reports in a short amount of time. [Means for solving the problem]

[0007] To solve the aforementioned problems, the present invention provides an information input unit that receives security-related information obtained from multiple information sources; an information relationship estimation unit that uses a natural language processing model to estimate the main security information, additional information related to the main security information, and facts mentioned by the additional information; and an editing unit that presents the results of the estimation by the information relationship estimation unit to the user and receives from the user the editing of the main security information, the additional information, and the facts mentioned by the additional information to be used in the security report. The system is characterized by comprising a report drafting unit that uses a natural language processing model to create and output a draft of the security report based on the edited main information, the additional information, and the facts mentioned by the additional information. [Effects of the Invention]

[0008] According to the present invention, highly readable security reports can be created in a short amount of time. [Brief explanation of the drawing]

[0009] [Figure 1] Figure 1 shows an example of a system configuration including a report generation device. [Figure 2] Figure 2 shows an example of how the information relationship estimation unit estimates relationships between pieces of information. [Figure 3] Figure 3 is a flowchart showing an example of the processing procedure performed by the information relationship estimation unit. [Figure 4] Figure 4 shows an example of an editing screen displayed by the Information Editorial Department. [Figure 5] Figure 5 shows an example of the processing steps performed by the report drafting department. [Figure 6] Figure 6 shows an example of supplementary information prepared by the report drafting department. [Figure 7] Figure 7 shows an example of the outline and annotations prepared by the report drafting department. [Figure 8] Figure 8 shows an example of a screen displayed by the report drafting editorial department. [Figure 9] Figure 9 shows an example of a computer running a report generation program. [Modes for carrying out the invention]

[0010] The following describes embodiments for carrying out the present invention with reference to the drawings. The present invention is not limited to these embodiments.

[0011] [overview] The report generation device of this embodiment will now be described. The report generation device uses an LLM (Large Language Model) on security information collected from multiple information sources, focusing on the relationships between the security information, to create and output a draft security report.

[0012] The explanation will use the LLM (Language-Language-Motion) model as an example for the natural language processing model used by the report generation device, but other natural language processing models may also be used. Furthermore, the security information may include security information in languages ​​other than English and Japanese.

[0013] [Example Configuration] Next, an example of the system configuration including the report generation device 10 will be described using Figure 1. The system comprises the report generation device 10 and an input device that receives various types of information from analysts. The report generation device 10 comprises, for example, an information preprocessing unit 11, an information relationship determination unit 12, and a report generation unit 13.

[0014] The information preprocessing unit 11 performs preprocessing of security information collected from a plurality of information sources (executes the "information preprocessing phase"). Also, the information relationship determination unit 12 estimates the relationships of each piece of information in order to accurately summarize a plurality of security information (executes the "information relationship determination phase"). Further, the report creation unit 13 creates a security report (report) based on the relationships of each piece of information estimated by the information relationship determination unit 12 (executes the "report creation phase"). Hereinafter, each phase will be described.

[0015] [Information preprocessing phase] In the information preprocessing phase, the information preprocessing unit 11, for example, extracts and formats information necessary for creating a draft report by the LLM from the information group input by the analyst. Then, the extracted and formatted information is confirmed by the analyst, and editing, omission of unnecessary information, etc. are performed. The information preprocessing unit 11 includes an information input unit 111, an information extraction unit 112, and an extracted information confirmation unit 113.

[0016] [Information input unit] The information input unit 111 receives the input of information that is the basis for a security report. For example, the information input unit 111 receives the input of security information in a prescribed format and the label of the security information.

[0017] Note that the security information received by the information input unit 111 is assumed to be information including natural language. The information may be singular or plural. Also, examples of the prescribed format include document files such as PDF, HTML, etc. Also, the label may be, for example, a label indicating the main information (details will be described later) used in the "information relationship determination phase".

[0018] Furthermore, the information extraction unit 112, described later, extracts not only natural language but also metadata such as the date the information was published and the entity that published it from the security information entered into the information input unit 111. However, if it is clear that the above information is not present in the security information, it can be added manually. In that case, the information input unit 111 accepts input such as information retrieved from a database using specific security keywords or vulnerability identifiers.

[0019] [Information extraction part] The information extraction unit 112 extracts from the information input unit 111 the natural language, which is the main body of the information handled by the report creation device 10, metadata such as the date and the entity that published the information, and vulnerability information such as CVSS (Common Vulnerability Scoring System) if the information is from a specific source.

[0020] As mentioned above, metadata such as the date of the information and the entity that published it may not be obtainable from natural language text. In such cases, extraction is performed separately. Also, metadata may not be present in the information entered into the information input unit 111. In such cases, the information entered into the information input unit 111 is passed to the extracted information confirmation unit 113 without any metadata.

[0021] Possible methods for extracting the above-mentioned natural language and metadata include a combination of various libraries and rule-based approaches, as well as the use of LLMs. Furthermore, if the information input to the information input unit 111 is more important as standardized vulnerability information than as natural language (for example, information from the National Vulnerability Database), then vulnerability information such as CVSS scores and CWE (Common Weakness Enumeration) can be extracted using a rule-based approach.

[0022] [Extracted Information Verification Unit] The extracted information confirmation unit 113 presents the information extracted by the information extraction unit 112 to the analyst. This allows the analyst to confirm the information extracted by the information extraction unit 112. The analyst can then modify or add to the information using the input device as needed. For example, if metadata is not present in the information extracted by the information extraction unit 112, the analyst can add information equivalent to metadata using the input device. The extracted information confirmation unit 113 outputs the modified or added information to the information relationship confirmation unit 12.

[0023] [Information Relationship Confirmation Phase] Next, we will explain the information relationship determination phase. When consolidating multiple security pieces of information into a single report, it is necessary to consider what information is included that is relevant to the event and whether it is primary information that is important for the accuracy of the report. However, the above work requires understanding the content of each document, which increases costs.

[0024] Therefore, in the information relationship determination phase of this embodiment, the information relationship determination unit 12 uses LLM to estimate facts mentioned by other information (additional information) in relation to the main information that forms the core of the security event described in the report, enabling the analyst to select and filter the information.

[0025] For example, the information relationship determination unit 12 performs the above estimation using few-shot prompting and a predetermined LLM based on the results of past information relationship determination phases. The information relationship determination unit 12 estimates the subject of the information (primary information source) and the points to be summarized using the LLM.

[0026] For example, the information relationship determination unit 12 estimates the relationships between the information (security information group) output from the information preprocessing unit 11 using an LLM that has been learned through few-shot prompting based on past reports (see Figure 2). Subsequently, the analyst confirms the estimation results and determines the relationships between the information. For example, the analyst selects and edits the information to be included in the report based on the estimation results. This information relationship determination unit 12 comprises an information relationship estimation unit 121 and an information relationship editing unit (editing unit) 122.

[0027] [Information Estimation Department] The information relationship estimation unit 121 uses LLM to determine whether the additional security information contained in the information output from the extracted information confirmation unit 113 is related to the main security information. Then, for the additional information that is determined to be related, the information relationship estimation unit 121 uses LLM to estimate the facts mentioned by the additional information (the primary source of the information mentioned by the additional information (the subject of the information) and the key points of the information) and outputs the estimation results.

[0028] For example, if there are multiple final outputs from the information preprocessing phase (information output from the extracted information verification unit 113), the information relationship estimation unit 121 estimates the main information (key information) in the report and the facts mentioned by other information (additional information) related to that key information.

[0029] For example, as shown in Figure 2, the Information Relationship Estimation Unit 121 estimates "product vendor vulnerability information" as the primary information from the security information group output from the Extracted Information Verification Unit 113, and estimates "vulnerability discoverer's blog," "NVD," "security vendor article," and "media article" as additional information. The Information Relationship Estimation Unit 121 then extracts additional information related to the primary information from the above additional information (for example, "vulnerability discoverer's blog," "NVD," "security vendor article," etc.). The Information Relationship Estimation Unit 121 then estimates the facts mentioned by the extracted additional information and outputs the estimation result.

[0030] Which information is primary information may be pre-labeled by the analyst, or it may be estimated by the information relationship estimation unit 121.

[0031] Criteria used to estimate key information include a time-series approach, which selects the earliest creation date, and a mention-based approach, which selects information that is frequently mentioned in other sources. In the case of a time-series approach, care must be taken when there is information with the same date.

[0032] The information relationship estimation unit 121 estimates the facts (information) that the additional information refers to in relation to the estimated main information (details are described below). For example, the information relationship estimation unit 121 estimates the subject (primary information source) and the perspective (point) to be summarized as facts that the additional information refers to. Note that multiple pairs of primary information sources and points may be estimated for a single piece of additional information.

[0033] Furthermore, the information relationship estimation unit 121 estimates whether the additional information is primary information or not. For example, if the subject of the information mentioned in the additional information is the same as the source of the information, the information relationship estimation unit 121 estimates that the additional information is primary information. On the other hand, if the subject of the information mentioned in the additional information is not the same as the source of the information, the information relationship estimation unit 121 estimates that the additional information is not primary information.

[0034] For example, if the additional information is media information, the primary source of the information does not necessarily match the entity that made the announcement, as described in the metadata extracted during the information preprocessing phase. In such cases, the information relationship estimation unit 121 determines that the additional information is secondary information. The information relationship estimation unit 121 then outputs the result of the above determination (information indicating that the additional information is secondary information).

[0035] For example, among the additional information shown in Figure 2, the primary source of the media article is the "(security) vendor article," but the entity that published it is the "media." In other words, the primary source of the media article does not match the entity that published it. In such cases, the information relationship estimation unit 121 determines that the media article is secondary information (secondary reporting on the vendor article) and outputs the result of that determination.

[0036] An example of the processing procedure executed by the Information Relationship Estimation Unit 121 will be explained using Figure 3. The Information Relationship Estimation Unit 121 uses LLM to determine whether or not there is additional information related to the main information among the additional information (additional information included in the information output from the Extracted Information Confirmation Unit 113) (S11). If the Information Relationship Estimation Unit 121 determines that there is additional information related to the main information (Yes in S12), it creates a short summary point about that additional information (S13). After that, the Information Relationship Estimation Unit 121 estimates the information subject of the point created in S13 (S14). On the other hand, if the Information Relationship Estimation Unit 121 determines that there is no additional information related to the main information (No in S12), it terminates the process.

[0037] In other words, the information relationship estimation unit 121 uses LLM to extract additional information related to the main information. However, LLM may cause hallucination, extracting information that is not related at all as being related. Therefore, the information relationship estimation unit 121 first uses LLM to determine whether the additional information is related to the main information, and then estimates the main subject of the additional information that has been determined to be related. The information relationship estimation unit 121 repeats the above process for each piece of additional information.

[0038] The information-related estimation unit 121 may also perform the above processing in a few-shot manner using points modified by the analyst. These points not only serve as a criterion for the analyst to decide whether or not to ultimately include the additional information in the report, but are also used by the LLM when drafting the report in the next phase (report creation phase).

[0039] Furthermore, the information relationship estimation unit 121 estimates the subject of the additional information as follows, for example. For example, consider the case where the additional information concerns a cyberattack. In this case, the information may be information about the cyberattack released by the victim company, or it may be comments from a representative of the victim company interviewed by the media. In such cases, the information relationship estimation unit 121 estimates the subject of the information to be "the victim company" if the information was released by the victim company. On the other hand, the information relationship estimation unit 121 estimates the subject of the information to be "the media" if the comments from a representative of the victim company interviewed by the media are relevant.

[0040] [Information Editorial Department] The Information-Related Editing Department 122 presents the results estimated by the Information-Related Estimation Department 121 (such as the relationship between the main information and additional information, the information subject and points of the additional information, as illustrated in Figure 2) to the analyst. The analyst reviews the presented results and inputs the editing content using the input device. The Information-Related Editing Department 122 then edits the results estimated by the Information-Related Estimation Department 121 based on the inputted editing content.

[0041] For example, the Information Editorial Department 122 displays information on the screen showing the relationship between the main information and the supplementary information (see Figure 2). After receiving input from an analyst to select one of the pieces of information, it displays the details of the selected piece of information (for example, the information subject (primary source) and key points) on the screen (see Figure 4). The Information Editorial Department 122 then accepts editing of the information from the screen shown above.

[0042] For example, an analyst can determine which information to use in the report based on the key information and additional information points displayed on the screen above. The analyst may also edit the additional information points using an input device to fine-tune the perspectives that the LLM will summarize in the next phase (report creation phase). This allows the analyst to change the elements they want to include in the report, and the edited results can be stored in the past report database (see Figure 1) for use in subsequent few-shot prompting and learning. The information editing department 122 finalizes the information after confirmation by the analyst.

[0043] [Report Creation Phase] Next, the report creation phase will be explained. In the report creation phase, based on the information confirmed in the information relationship confirmation phase, the report creation unit 13 creates a draft report using LLM. Then, the analyst creates the final report based on the draft report. The report creation unit 13 comprises a report draft creation unit 131 and a report draft editing unit 132.

[0044] [Report Drafting Department] The report drafting team 131 uses LLM to create a draft of the report based on the information confirmed in the information confirmation phase.

[0045] For example, the report drafting unit 131 uses LLM to perform the following processing on the information confirmed in the information relationship confirmation phase (main information and the points of information mentioned by additional information related to that main information).

[0046] For example, the report drafting unit 131 uses LLM to create a verbose summary of terms that are presumed to be highly specialized, based on the information confirmed in the information relationship confirmation phase. Next, the report drafting unit 131 creates annotations where the number of characters in the summary can be shortened by using annotations. After that, the report drafting unit 131 creates a draft of the report by adding the above annotations to the shortened summary.

[0047] The process performed by the report drafting unit 131 will be explained using Figure 5. As shown in Figure 5, the report drafting unit 131 first creates an outline of the main information, and then creates an outline of the additional information.

[0048] [Creating an outline of key information] The report drafting unit 131 prepares an outline of the main information using the following procedure. First, the report drafting unit 131 instructs the LLM to create a "redundant outline" (S21) that includes sufficient explanations for words and events that are not common in security documents, based on the content of the main information confirmed in the information relationship confirmation phase.

[0049] Next, the report drafting unit 131 instructs the LLM to identify sections of the redundant outline created in S21 that can be shortened as annotations (S22), and to create an annotated outline (shortened outline) (S23). After that, the report drafting unit 131 creates supplementary information from the information that does not fit into the outline (S24).

[0050] [Creating an outline of additional information] Subsequently, the report drafting unit 131 creates an outline of the additional information. First, the report drafting unit 131 creates an outline similar to the above, based on the points of the additional information that were confirmed in the information relationship confirmation phase.

[0051] For example, the report drafting unit 131 instructs the LLM to create a "redundant summary" that includes sufficient explanations of words and events that are not common in security documents, according to the points of additional information (S25). Next, the report drafting unit 131 instructs the LLM to specify the parts of the redundant summary created in S25 that can be shortened as annotations (S26), and to create an annotated summary (shortened summary) (S27). After that, the report drafting unit 131 instructs the LLM to insert the annotated summary created in S27 into the supplementary information of the main information (S28).

[0052] After S28, if there is any additional information for which an outline has not yet been created (Yes in S29), the report drafting unit 131 executes the processing from S25 onwards on the additional information for which an outline has not yet been created. On the other hand, if there is no additional information for which an outline has not yet been created (No in S29), the report drafting unit 131 terminates the processing.

[0053] Furthermore, the report drafting unit 131 may create a draft report using a few-shot approach with security reports (final security reports corrected by analysts) stored in the past report database (see Figure 1). The report drafting unit 131 may also create multiple draft reports by using multiple LLM models. This allows analysts to choose from multiple draft reports, and also enables analysts to notice if an LLM has created an incorrect draft report.

[0054] The report drafting unit 131 can create a draft report containing all the necessary and sufficient information by performing the above process.

[0055] In other words, generally speaking, when LLM is used to summarize highly specialized security documents, it is difficult to provide sufficient explanations for event-specific terminology. Furthermore, even when LLM is used to annotate highly specialized security documents, the annotations may be either insufficient or excessive.

[0056] On the other hand, the report drafting unit 131 solves this problem by dividing the creation of an outline for a highly specialized security document by LLM into the following three subphases.

[0057] (1) Create an outline (a verbose outline) that includes sufficient explanations for highly specialized proper nouns. (2) Look for parts of the redundant summary that can be shortened by adding annotations. (3) Create a short summary by using annotations.

[0058] This allows the report drafting unit 131 to supplement information with appropriate annotations when creating a draft report, and to make the summary short and easy to understand. For example, the report drafting unit 131 can add explanations for highly specialized terminology and unique units of measurement that are difficult for even analysts to grasp. Furthermore, a report that is supplemented with appropriate annotations and has a short, easy-to-understand summary is useful for reports that require timeliness.

[0059] [Example of a draft report] Next, we will explain an example of a draft report created by the Report Drafting Department 131. Here, we will explain the case where the Report Drafting Department 131 creates a draft report by adding key points from information (supplementary information) published by a security company to the vulnerability information (main information) published by the vendor. It is assumed that the Report Drafting Department 131 has already created an outline and supplementary information for the vulnerability information (main information) published by the vendor.

[0060] In this case, the report drafting unit 131 inserts, for example, an outline of the additional information (see reference numeral 603) created based on the estimated points of the additional information (see reference numeral 602) into the supplementary information of the vulnerability information (see reference numeral 601) published by the vendor, as shown in Figure 6.

[0061] Furthermore, the report drafting unit 131 shortens the main information and the summary of additional information, for example, as follows. For example, as shown by reference numeral 701 in Figure 7, the report drafting unit 131 causes the LLM to create a verbose summary that includes sufficient explanations for highly specialized proper nouns ((1)).

[0062] Next, the report drafting unit 131 searches for places in the redundant outline created in (1) that can be shortened as annotations ((2)). For example, the report drafting unit 131 searches the initial outline shown in reference numeral 701 for places where the keyword shown in reference numeral 702 can be shortened as an annotation.

[0063] Subsequently, the report drafting unit 131 creates a short outline using annotations found in (2) ((3)). For example, the report drafting unit 131 creates the "final outline" and "final annotations" shown in reference numeral 703.

[0064] In this way, the report drafting unit 131 can create a draft report that is supplemented with appropriate annotations and has a concise and easy-to-understand summary.

[0065] [Report Draft Editorial Department] The report draft editing department 132 presents the report draft (see reference numeral 801 in Figure 8) created by the report draft creation department 131 to the analyst. The analyst reviews the report draft presented by the report draft editing department 132 and inputs the report's edits using the input device.

[0066] For example, the report draft editing department displays the input screen shown as reference numeral 802 in Figure 8 and accepts input from analysts regarding the content of the report to be edited (e.g., title, summary, minor wording changes in supplementary information, notes, etc.). The report draft editing department 132 then revises the report draft based on the input content and outputs the revised report draft as the final report.

[0067] According to the report generation device 10 described above, analysts can determine whether or not a given piece of security information is relevant to an event without having to examine each piece of security information in detail when creating a report.

[0068] Furthermore, analysts can verify whether the security information used in creating the report is primary information, which is crucial for the accuracy of the report. In addition, the report creation device 10 can create short and easy-to-understand documents by adding appropriate annotations using LLM to security information that frequently contains highly specialized terminology or terminology unique to the event. As a result, even analysts who are not proficient in creating security reports can create highly readable security reports in a short amount of time.

[0069] In the embodiments described above, the report creation device 10 accepts edits from the analyst regarding the results estimated by the information relationship estimation unit 121 and edits to the draft report before creating the final report, but it is not limited to this. For example, the report creation device 10 may create the final report without any editing by the analyst.

[0070] [System configuration, etc.] Furthermore, the components of each part shown in the diagram are functional concepts and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown in the diagram, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. Moreover, all or any part of the processing functions performed by each device can be realized by a CPU and the program executed on that CPU, or by hardware using wired logic.

[0071] Furthermore, among the processes described in the embodiments described above, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0072] [program] The aforementioned report creation device 10 can be implemented by installing a program (report creation program) as packaged software or online software on a desired computer. For example, by having the above program run on an information processing device, the information processing device can function as the report creation device 10. The information processing device referred to here includes mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone System), as well as terminals such as PDA (Personal Digital Assistant).

[0073] Figure 9 shows an example of a computer running a report generation program. Computer 1000 has, for example, memory 1010 and a CPU 1020. Computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0074] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM (Random Access Memory) 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0075] The hard disk drive 1090 stores, for example, the OS 1091, application program 1092, program module 1093, and program data 1094. That is, the program that defines each process executed by the report generation device 10 is implemented as a program module 1093 in which executable code for a computer is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to the functional configuration of the report generation device 10 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0076] Furthermore, the data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. The CPU 1020 then reads the program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed and executes them.

[0077] Furthermore, the program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090; for example, they may be stored in a removable storage medium and read by the CPU 1020 via a disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via a network interface 1070. [Explanation of symbols]

[0078] 10. Report generation device 11. Information Preprocessing Unit 12 Information Confirmation Section 13. Report Creation Department 111 Information Input Section 112 Information extraction part 113 Extracted Information Verification Unit 121 Information-Related Estimation Department 122 Information Editorial Department 131 Report Drafting Department 132 Report Draft Editorial Department

Claims

1. An information input unit that accepts security-related information obtained from multiple sources, An information relationship estimation unit uses a natural language processing model to estimate the main security information, additional information related to the main security information, and facts mentioned by the additional information, based on the input information. An editorial department presents the results of the estimation by the information relationship estimation unit to the user, and accepts from the user the editing of the main information, the additional information, and the facts mentioned by the additional information to be used in the security report. A report drafting unit creates and outputs a draft of the security report based on the edited main information, the additional information, and the facts mentioned by the additional information, using a natural language processing model. A report creation device characterized by comprising the following features.

2. The facts mentioned in the aforementioned additional information are the subject of the information mentioned in the additional information and the point of the information. The report creation device according to feature 1.

3. The aforementioned information relationship estimation unit further, If it is determined that the entity that the aforementioned additional information refers to is different from the entity that published the additional information, the additional information will be presumed to be secondary information. The report creation device according to feature 2.

4. The aforementioned report drafting department, Using a natural language processing model, a draft of the report is created by generating a verbose summary of the main information and the points of the information mentioned by the additional information related to the main information, using terms that are presumed to be highly specialized, adding annotations to the generated summary where the number of characters in the summary can be shortened by adding annotations to the shortened summary, and then adding the annotations to the shortened summary. The report creation device according to feature 2.

5. The aforementioned information relationship estimation unit, If the input information does not include information indicating whether or not it is primary security information, the system will estimate whether or not the information is primary security information based on at least one of the following: the time it was created and the frequency of references to it in other information. The report creation apparatus according to feature 1.

6. A report generation method performed by a report generation device, The process involves receiving input of security information obtained from multiple sources, A process of using a natural language processing model to estimate the key security information, additional information related to the key security information, and facts mentioned by the additional information, based on the input information. The process includes presenting the results of the estimation to the user, and receiving from the user an edit of the main information, the additional information, and the facts mentioned by the additional information to be used in the security report, A process of creating and outputting a draft security report based on the edited main information, the additional information, and the facts mentioned by the additional information, using a natural language processing model. A method for creating a report characterized by including the following.

7. The process involves receiving input of security information obtained from multiple sources, A process of using a natural language processing model to estimate the key security information, additional information related to the key security information, and facts mentioned by the additional information, based on the input information. The process includes presenting the results of the estimation to the user, and receiving from the user an edit of the main information, the additional information, and the facts mentioned by the additional information to be used in the security report, A process of creating and outputting a draft security report based on the edited main information, the additional information, and the facts mentioned by the additional information, using a natural language processing model. A report generation program that instructs a computer to execute a report.

Images